I have a hard time understandin which of the following protocols is susceptible to replay attack:
A -----> B username, password
A -----> B username, h(timestamp,password)
A -----> B username timestamp, h(password)
A -----> B username, h(timestamp), h(password)
I think the answer is 1 and 3
I know 2) is secure because the password and time-stamp are hashed together, I know 1) is definitely insecure. 3) is insecure if somehow the intruder gets to know the time-stamp he may replay it. I am slightly confused about 4) while it is true that we can't get the time-stamp from hash. I was wondering if it is possible to brute force a time stamp. I think there wouldn't be a lot of time difference between when the packet was sent and the time intruder intercepted it. Is it possible and send all possible timestamps until B accepts it?